Fix workflow permissions, enable manual triggering, and resolve lint errors - #53
Merged
Conversation
Add explicit permissions for packages: write to allow the deploy workflow to push container images to GitHub Container Registry. The hassio-addons/workflows addon-deploy.yaml workflow requires packages: write permission, which must be explicitly granted by the calling workflow.
Add explicit permissions to match the requirements of the hassio-addons/workflows addon-ci.yaml workflow, which requires actions: read, contents: read, packages: read, and security-events: write permissions.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
- Add workflow_dispatch trigger to Deploy workflow to allow manual triggering - Add hadolint ignore comments to Dockerfile for: - DL3006: LABEL maintainer position - DL3003: Multiple RUN commands - Fix formatting in Dockerfile comments This allows users to manually trigger the deploy workflow from the GitHub UI.
mdeweerd
changed the title
- Remove deprecated armv7 architecture from config.yaml and build.yaml - Change version from 'v2026.5.3' to 'dev' to satisfy add-on linter requirement - Add comments explaining armv7 deprecation This fixes the Lint App failures: - Warning: Architecture 'armv7' is deprecated and no longer supported as of Home Assistant 2025.12 - Error: Add-on version identifier must be 'dev'
mdeweerd
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Update the versions of various GitHub Actions used in the CI workflow to their latest stable versions. This ensures we're using the most recent features, security patches, and improvements provided by these actions.
Add repository configuration file with name and URL for the MetersToHA project. This file is required for Home Assistant to recognize and install the app.
The security-events write permission was removed from the CI workflow configuration to reduce unnecessary permissions and enhance security. This change aligns with the principle of least privilege, ensuring that the workflow only has the permissions it needs to function properly.
- Replace hassio-addons deploy workflow with Home Assistant builder actions - Use home-assistant/builder/actions for multi-arch image building - Publish images with version tags and latest tag - Remove redundant build.yaml and docker-image_new.yml workflows - Keep CI workflow focused on linting and validation - Add script to update config.yaml version for future use This aligns the deploy flow with the documentation at: https://developers.home-assistant.io/docs/apps/publishing Based on the example repository: home-assistant/apps-example
- Change hadolint-action from commit SHA to v1.5.0 tag - Change shellcheck from commit SHA to 2.0.0 tag - Change prettier_action from commit SHA to v4.6 tag - Fix YAML spacing for comments This fixes the GitHub Actions errors where commit SHAs could not be resolved.
…errors The script was causing mypy import errors in pre-commit hooks.
This fixes the permission error in the zizmor security scanner.
Update the version of svenstaro/upload-release-action from v1-release to 2.11.5 to ensure compatibility with the latest GitHub Actions features and security improvements.
- Remove `security-events: write` permission from addon-ci.yml - Update actions/checkout to use specific commit SHA in deploy.yaml
Update the version of the publish-multi-arch-manifest action to a specific commit hash for better stability and reproducibility.
Added 'security-events: read' permission to allow the workflow to read security events. This is necessary for security-related workflows and integrations.
mdeweerd
marked this pull request as ready for review
May 26, 2026 00:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix workflow permissions, enable manual triggering, and resolve lint errors.
Changes
Workflow Fixes
deploy.yaml:
permissions: contents: read, packages: write(required by addon-deploy.yaml)workflow_dispatchtrigger to allow manual triggering from GitHub UIaddon-ci.yml:
permissions: actions: read, contents: read, packages: read, security-events: write(required by addon-ci.yaml)Dockerfile Fixes
Lint App Fixes
addon_meterstoha/config.yaml:
armv7architecture from arch list"v2026.5.3"todev(required by add-on linter)addon_meterstoha/build.yaml:
armv7architecture from build_from configurationProblems Solved
Workflow Permissions
The hassio-addons reusable workflows require explicit permissions to be granted by the calling workflow. Without these permissions, the workflows fail with a validation error: "The workflow is not valid... The workflow is requesting 'packages: write', but is only allowed 'packages: read'."
Manual Triggering
The Deploy workflow can now be manually triggered from the GitHub Actions UI at:
https://github.com/mdeweerd/meterstoha/actions/workflows/DeployLint Errors